docs-xml/manpages/samba-tool.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="samba-tool.8">
   4
   5 <refmeta>
   6         <refentrytitle>samba-tool</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">&doc.version;</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>samba-tool</refname>
  16         <refpurpose>Main Samba administration tool.
  17         </refpurpose>
  18 </refnamediv>
  19
  20 <refsynopsisdiv>
  21         <cmdsynopsis>
  22                 <command>samba-tool</command>
  23                 <arg choice="opt">-h</arg>
  24                 <arg choice="opt">-W myworkgroup</arg>
  25                 <arg choice="opt">-U user</arg>
  26                 <arg choice="opt">-d debuglevel</arg>
  27                 <arg choice="opt">--v</arg>
  28         </cmdsynopsis>
  29 </refsynopsisdiv>
  30
  31 <refsect1>
  32         <title>DESCRIPTION</title>
  33         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  34         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  35 </refsect1>
  36
  37 <refsect1>
  38         <title>OPTIONS</title>
  39
  40         <variablelist>
  41
  42         <varlistentry>
  43         <term>-h|--help</term>
  44         <listitem><para>
  45         Show this help message and exit
  46         </para></listitem>
  47         </varlistentry>
  48
  49         <varlistentry>
  50         <term>--realm=REALM</term>
  51         <listitem><para>
  52         Set the realm name
  53         </para></listitem>
  54         </varlistentry>
  55
  56         <varlistentry>
  57         <term>--simple-bind-dn=DN</term>
  58         <listitem><para>
  59         DN to use for a simple bind
  60         </para></listitem>
  61         </varlistentry>
  62
  63         <varlistentry>
  64         <term>--password=PASSWORD</term>
  65         <listitem><para>
  66         Password
  67         </para></listitem>
  68         </varlistentry>
  69
  70         <varlistentry>
  71         <term>-U USERNAME|--username=USERNAME</term>
  72         <listitem><para>
  73         Username
  74         </para></listitem>
  75         </varlistentry>
  76
  77         <varlistentry>
  78         <term>-W WORKGROUP|--workgroup=WORKGROUP</term>
  79         <listitem><para>
  80         Workgroup
  81         </para></listitem>
  82         </varlistentry>
  83
  84         <varlistentry>
  85         <term>-N|--no-pass</term>
  86         <listitem><para>
  87         Don't ask for a password
  88         </para></listitem>
  89         </varlistentry>
  90
  91         <varlistentry>
  92         <term>-k KERBEROS|--kerberos=KERBEROS</term>
  93         <listitem><para>
  94         Use Kerberos
  95         </para></listitem>
  96         </varlistentry>
  97
  98         <varlistentry>
  99         <term>--ipaddress=IPADDRESS</term>
 100         <listitem><para>
 101         IP address of the server
 102         </para></listitem>
 103         </varlistentry>
 104
 105         &popt.common.samba.client;
 106
 107         </variablelist>
 108 </refsect1>
 109
 110 <refsect1>
 111 <title>COMMANDS</title>
 112
 113 <refsect2>
 114         <title>computer</title>
 115         <para>Manage computer accounts.</para>
 116 </refsect2>
 117
 118 <refsect3>
 119         <title>computer create <replaceable>computername</replaceable> [options]</title>
 120         <para>Create a new computer in the Active Directory Domain.</para>
 121         <para>The new computer name specified on the command is the
 122         sAMAccountName, with or without the trailing dollar sign.</para>
 123
 124         <variablelist>
 125         <varlistentry>
 126         <term>--computerou=COMPUTEROU</term>
 127         <listitem><para>
 128         DN of alternative location (with or without domainDN counterpart) to
 129         default CN=Computers in which new computer object will be created.
 130         E.g. 'OU=OUname'.
 131         </para></listitem>
 132         </varlistentry>
 133
 134         <varlistentry>
 135         <term>--description=DESCRIPTION</term>
 136         <listitem><para>
 137         The new computers's description.
 138         </para></listitem>
 139         </varlistentry>
 140
 141         <varlistentry>
 142         <term>--ip-address=IP_ADDRESS_LIST</term>
 143         <listitem><para>
 144         IPv4 address for the computer's A record, or IPv6 address for AAAA record,
 145         can be provided multiple times.
 146         </para></listitem>
 147         </varlistentry>
 148
 149         <varlistentry>
 150         <term>--service-principal-name=SERVICE_PRINCIPAL_NAME_LIST</term>
 151         <listitem><para>
 152         Computer's Service Principal Name, can be provided multiple times.
 153         </para></listitem>
 154         </varlistentry>
 155
 156         <varlistentry>
 157         <term>--prepare-oldjoin</term>
 158         <listitem><para>
 159         Prepare enabled machine account for oldjoin mechanism.
 160         </para></listitem>
 161         </varlistentry>
 162         </variablelist>
 163 </refsect3>
 164
 165 <refsect3>
 166         <title>computer delete <replaceable>computername</replaceable> [options]</title>
 167         <para>Delete an existing computer account.</para>
 168         <para>The computer name specified on the command is the
 169         sAMAccountName, with or without the trailing dollar sign.</para>
 170 </refsect3>
 171
 172 <refsect3>
 173         <title>computer edit <replaceable>computername</replaceable></title>
 174         <para>Edit a computer AD object.</para>
 175         <para>The computer name specified on the command is the
 176         sAMAccountName, with or without the trailing dollar sign.</para>
 177
 178         <variablelist>
 179         <varlistentry>
 180         <term>--editor=EDITOR</term>
 181         <listitem><para>
 182         Specifies the editor to use instead of the system default, or 'vi' if no
 183         system default is set.
 184         </para></listitem>
 185         </varlistentry>
 186         </variablelist>
 187 </refsect3>
 188
 189 <refsect3>
 190         <title>computer list</title>
 191         <para>List all computers.</para>
 192 </refsect3>
 193
 194 <refsect3>
 195         <title>computer move <replaceable>computername</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 196         <para>This command moves a computer account into the specified
 197         organizational unit or container.</para>
 198         <para>The computername specified on the command is the
 199         sAMAccountName, with or without the trailing dollar sign.</para>
 200         <para>The name of the organizational unit or container can be
 201         specified as a full DN or without the domainDN component.</para>
 202 </refsect3>
 203
 204 <refsect3>
 205         <title>computer show <replaceable>computername</replaceable> [options]</title>
 206         <para>Display a computer AD object.</para>
 207         <para>The computer name specified on the command is the
 208         sAMAccountName, with or without the trailing dollar sign.</para>
 209
 210         <variablelist>
 211         <varlistentry>
 212         <term>--attributes=USER_ATTRS</term>
 213         <listitem><para>
 214         Comma separated list of attributes, which will be printed.
 215         </para></listitem>
 216         </varlistentry>
 217         </variablelist>
 218 </refsect3>
 219
 220 <refsect2>
 221         <title>contact</title>
 222         <para>Manage contacts.</para>
 223 </refsect2>
 224
 225 <refsect3>
 226         <title>contact create [<replaceable>contactname</replaceable>] [options]</title>
 227         <para>Create a new contact in the Active Directory Domain.</para>
 228         <para>The name of the new contact can be specified by the first
 229         argument 'contactname' or the --given-name, --initial and --surname
 230         arguments. If no 'contactname' is given, contact's name will be made
 231         up of the given arguments by combining the given-name, initials and
 232         surname. Each argument is optional. A dot ('.') will be appended to
 233         the initials automatically.</para>
 234
 235         <variablelist>
 236         <varlistentry>
 237         <term>--ou=OU</term>
 238         <listitem><para>
 239         DN of alternative location (with or without domainDN counterpart) in
 240         which the new contact will be created.
 241         E.g. 'OU=OUname'.
 242         Default is the domain base.
 243         </para></listitem>
 244         </varlistentry>
 245
 246         <varlistentry>
 247         <term>--description=DESCRIPTION</term>
 248         <listitem><para>
 249         The new contacts's description.
 250         </para></listitem>
 251         </varlistentry>
 252
 253         <varlistentry>
 254         <term>--surname=SURNAME</term>
 255         <listitem><para>
 256         Contact's surname.
 257         </para></listitem>
 258         </varlistentry>
 259
 260         <varlistentry>
 261         <term>--given-name=GIVEN_NAME</term>
 262         <listitem><para>
 263         Contact's given name.
 264         </para></listitem>
 265         </varlistentry>
 266
 267         <varlistentry>
 268         <term>--initials=INITIALS</term>
 269         <listitem><para>
 270         Contact's initials.
 271         </para></listitem>
 272         </varlistentry>
 273
 274         <varlistentry>
 275         <term>--display-name=DISPLAY_NAME</term>
 276         <listitem><para>
 277         Contact's display name.
 278         </para></listitem>
 279         </varlistentry>
 280
 281         <varlistentry>
 282         <term>--job-title=JOB_TITLE</term>
 283         <listitem><para>
 284         Contact's job title.
 285         </para></listitem>
 286         </varlistentry>
 287
 288         <varlistentry>
 289         <term>--department=DEPARTMENT</term>
 290         <listitem><para>
 291         Contact's department.
 292         </para></listitem>
 293         </varlistentry>
 294
 295         <varlistentry>
 296         <term>--company=COMPANY</term>
 297         <listitem><para>
 298         Contact's company.
 299         </para></listitem>
 300         </varlistentry>
 301
 302         <varlistentry>
 303         <term>--mail-address=MAIL_ADDRESS</term>
 304         <listitem><para>
 305         Contact's email address.
 306         </para></listitem>
 307         </varlistentry>
 308
 309         <varlistentry>
 310         <term>--internet-address=INTERNET_ADDRESS</term>
 311         <listitem><para>
 312         Contact's home page.
 313         </para></listitem>
 314         </varlistentry>
 315
 316         <varlistentry>
 317         <term>--telephone-number=TELEPHONE_NUMBER</term>
 318         <listitem><para>
 319         Contact's phone number.
 320         </para></listitem>
 321         </varlistentry>
 322
 323         <varlistentry>
 324         <term>--mobile-number=MOBILE_NUMBER</term>
 325         <listitem><para>
 326         Contact's mobile phone number.
 327         </para></listitem>
 328         </varlistentry>
 329
 330         <varlistentry>
 331         <term>--physical-delivery-office=PHYSICAL_DELIVERY_OFFICE</term>
 332         <listitem><para>
 333         Contact's office location.
 334         </para></listitem>
 335         </varlistentry>
 336
 337         </variablelist>
 338 </refsect3>
 339
 340 <refsect3>
 341         <title>contact delete <replaceable>contactname</replaceable> [options]</title>
 342         <para>Delete an existing contact.</para>
 343         <para>The contactname specified on the command is the common name or the
 344         distinguished name of the contact object. The distinguished name of the
 345         contact can be specified with or without the domainDN component.</para>
 346 </refsect3>
 347
 348 <refsect3>
 349         <title>contact edit <replaceable>contactname</replaceable></title>
 350         <para>Modify a contact AD object.</para>
 351         <para>The contactname specified on the command is the common name or the
 352         distinguished name of the contact object. The distinguished name of the
 353         contact can be specified with or without the domainDN component.</para>
 354
 355         <variablelist>
 356         <varlistentry>
 357         <term>--editor=EDITOR</term>
 358         <listitem><para>
 359         Specifies the editor to use instead of the system default, or 'vi' if no
 360         system default is set.
 361         </para></listitem>
 362         </varlistentry>
 363         </variablelist>
 364 </refsect3>
 365
 366 <refsect3>
 367         <title>contact list [options]</title>
 368         <para>List all contacts.</para>
 369
 370         <variablelist>
 371         <varlistentry>
 372         <term>--full-dn</term>
 373         <listitem><para>
 374         Display contact's full DN instead of the name.
 375         </para></listitem>
 376         </varlistentry>
 377         </variablelist>
 378 </refsect3>
 379
 380 <refsect3>
 381         <title>contact move <replaceable>contactname</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 382         <para>This command moves a contact into the specified organizational
 383         unit or container.</para>
 384         <para>The contactname specified on the command is the common name or the
 385         distinguished name of the contact object. The distinguished name of the
 386         contact can be specified with or without the domainDN component.</para>
 387 </refsect3>
 388
 389 <refsect3>
 390         <title>contact show <replaceable>contactname</replaceable> [options]</title>
 391         <para>Display a contact AD object.</para>
 392         <para>The contactname specified on the command is the common name or the
 393         distinguished name of the contact object. The distinguished name of the
 394         contact can be specified with or without the domainDN component.</para>
 395
 396         <variablelist>
 397         <varlistentry>
 398         <term>--attributes=CONTACT_ATTRS</term>
 399         <listitem><para>
 400         Comma separated list of attributes, which will be printed.
 401         </para></listitem>
 402         </varlistentry>
 403         </variablelist>
 404 </refsect3>
 405
 406 <refsect2>
 407         <title>dbcheck</title>
 408         <para>Check the local AD database for errors.</para>
 409 </refsect2>
 410
 411 <refsect2>
 412         <title>delegation</title>
 413         <para>Manage Delegations.</para>
 414 </refsect2>
 415
 416 <refsect3>
 417         <title>delegation add-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 418         <para>Add a service principal as msDS-AllowedToDelegateTo.</para>
 419 </refsect3>
 420
 421 <refsect3>
 422         <title>delegation del-service <replaceable>accountname</replaceable> <replaceable>principal</replaceable> [options]</title>
 423         <para>Delete a service principal as msDS-AllowedToDelegateTo.</para>
 424 </refsect3>
 425
 426 <refsect3>
 427         <title>delegation for-any-protocol <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 428         <para>Set/unset UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (S4U2Proxy)
 429         for an account.</para>
 430 </refsect3>
 431
 432 <refsect3>
 433         <title>delegation for-any-service <replaceable>accountname</replaceable> [(on|off)] [options]</title>
 434         <para>Set/unset UF_TRUSTED_FOR_DELEGATION for an account.</para>
 435 </refsect3>
 436
 437 <refsect3>
 438         <title>delegation show <replaceable>accountname</replaceable> [options] </title>
 439         <para>Show the delegation setting of an account.</para>
 440 </refsect3>
 441
 442 <refsect2>
 443         <title>dns</title>
 444         <para>Manage Domain Name Service (DNS).</para>
 445 </refsect2>
 446
 447 <refsect3>
 448         <title>dns add <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 449         <para>Add a DNS record.</para>
 450 </refsect3>
 451
 452 <refsect3>
 453         <title>dns delete <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>data</replaceable></title>
 454         <para>Delete a DNS record.</para>
 455 </refsect3>
 456
 457 <refsect3>
 458         <title>dns query <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT|ALL</replaceable> [options] <replaceable>data</replaceable></title>
 459         <para>Query a name.</para>
 460 </refsect3>
 461
 462 <refsect3>
 463         <title>dns roothints <replaceable>server</replaceable> [<replaceable>name</replaceable>] [options]</title>
 464         <para>Query root hints.</para>
 465 </refsect3>
 466
 467 <refsect3>
 468         <title>dns serverinfo <replaceable>server</replaceable> [options]</title>
 469         <para>Query server information.</para>
 470 </refsect3>
 471
 472 <refsect3>
 473         <title>dns update <replaceable>server</replaceable> <replaceable>zone</replaceable> <replaceable>name</replaceable> <replaceable>A|AAAA|PTR|CNAME|NS|MX|SRV|TXT</replaceable> <replaceable>olddata</replaceable> <replaceable>newdata</replaceable></title>
 474         <para>Update a DNS record.</para>
 475 </refsect3>
 476
 477 <refsect3>
 478         <title>dns zonecreate <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 479         <para>Create a zone.</para>
 480 </refsect3>
 481
 482 <refsect3>
 483         <title>dns zonedelete <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 484         <para>Delete a zone.</para>
 485 </refsect3>
 486
 487 <refsect3>
 488         <title>dns zoneinfo <replaceable>server</replaceable> <replaceable>zone</replaceable> [options]</title>
 489         <para>Query zone information.</para>
 490 </refsect3>
 491
 492 <refsect3>
 493         <title>dns zonelist <replaceable>server</replaceable> [options]</title>
 494         <para>List zones.</para>
 495 </refsect3>
 496
 497 <refsect2>
 498         <title>domain</title>
 499         <para>Manage Domain.</para>
 500 </refsect2>
 501
 502 <refsect3>
 503         <title>domain backup</title>
 504         <para>Create or restore a backup of the domain.</para>
 505 </refsect3>
 506
 507 <refsect3>
 508         <title>domain backup offline</title>
 509         <para>Backup (with proper locking) local domain directories into a tar file.</para>
 510 </refsect3>
 511
 512 <refsect3>
 513         <title>domain backup online</title>
 514         <para>Copy a running DC's current DB into a backup tar file.</para>
 515 </refsect3>
 516
 517 <refsect3>
 518         <title>domain backup rename</title>
 519         <para>Copy a running DC's DB to backup file, renaming the domain in the process.</para>
 520 </refsect3>
 521
 522 <refsect3>
 523         <title>domain backup restore</title>
 524         <para>Restore the domain's DB from a backup-file.</para>
 525 </refsect3>
 526
 527 <refsect3>
 528         <title>domain classicupgrade [options] <replaceable>classic_smb_conf</replaceable></title>
 529         <para>Upgrade from Samba classic (NT4-like) database to Samba AD DC
 530         database.</para>
 531 </refsect3>
 532
 533 <refsect3>
 534         <title>domain dcpromo <replaceable>dnsdomain</replaceable> [DC|RODC] [options]</title>
 535         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 536 </refsect3>
 537
 538 <refsect3>
 539         <title>domain demote</title>
 540         <para>Demote ourselves from the role of domain controller.</para>
 541 </refsect3>
 542
 543 <refsect3>
 544         <title>domain exportkeytab <replaceable>keytab</replaceable> [options]</title>
 545         <para>Dumps Kerberos keys of the domain into a keytab.</para>
 546 </refsect3>
 547
 548 <refsect3>
 549         <title>domain info <replaceable>ip_address</replaceable> [options]</title>
 550         <para>Print basic info about a domain and the specified DC.
 551 </para>
 552 </refsect3>
 553
 554 <refsect3>
 555         <title>domain join <replaceable>dnsdomain</replaceable> [DC|RODC|MEMBER|SUBDOMAIN] [options]</title>
 556         <para>Join a domain as either member or backup domain controller.</para>
 557 </refsect3>
 558
 559 <refsect3>
 560         <title>domain level <replaceable>show|raise</replaceable> <replaceable>options</replaceable> [options]</title>
 561         <para>Show/raise domain and forest function levels.</para>
 562 </refsect3>
 563
 564 <refsect3>
 565         <title>domain passwordsettings <replaceable>show|set</replaceable> <replaceable>options</replaceable> [options]</title>
 566         <para>Show/set password settings.</para>
 567 </refsect3>
 568
 569 <refsect3>
 570         <title>domain passwordsettings pso</title>
 571         <para>Manage fine-grained Password Settings Objects (PSOs).</para>
 572 </refsect3>
 573
 574 <refsect3>
 575         <title>domain passwordsettings pso apply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 576         <para>Applies a PSO's password policy to a user or group.</para>
 577 </refsect3>
 578
 579 <refsect3>
 580         <title>domain passwordsettings pso create <replaceable>pso-name</replaceable> <replaceable>precedence</replaceable> [options]</title>
 581         <para>Creates a new Password Settings Object (PSO).</para>
 582 </refsect3>
 583
 584 <refsect3>
 585         <title>domain passwordsettings pso delete <replaceable>pso-name</replaceable> [options]</title>
 586         <para>Deletes a Password Settings Object (PSO).</para>
 587 </refsect3>
 588
 589 <refsect3>
 590         <title>domain passwordsettings pso list [options]</title>
 591         <para>Lists all Password Settings Objects (PSOs).</para>
 592 </refsect3>
 593
 594 <refsect3>
 595         <title>domain passwordsettings pso set <replaceable>pso-name</replaceable> [options]</title>
 596         <para>Modifies a Password Settings Object (PSO).</para>
 597 </refsect3>
 598
 599 <refsect3>
 600         <title>domain passwordsettings pso show <replaceable>user-name</replaceable> [options]</title>
 601         <para>Displays a Password Settings Object (PSO).</para>
 602 </refsect3>
 603
 604 <refsect3>
 605         <title>domain passwordsettings pso show-user <replaceable>pso-name</replaceable> [options]</title>
 606         <para>Displays the Password Settings that apply to a user.</para>
 607 </refsect3>
 608
 609 <refsect3>
 610         <title>domain passwordsettings pso unapply <replaceable>pso-name</replaceable> <replaceable>user-or-group-name</replaceable> [options]</title>
 611         <para>Updates a PSO to no longer apply to a user or group.</para>
 612 </refsect3>
 613
 614 <refsect3>
 615         <title>domain provision</title>
 616         <para>Promote an existing domain member or NT4 PDC to an AD DC.</para>
 617 </refsect3>
 618
 619 <refsect3>
 620         <title>domain trust</title>
 621         <para>Domain and forest trust management.</para>
 622 </refsect3>
 623
 624 <refsect3>
 625         <title>domain trust create <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 626         <para>Create a domain or forest trust.</para>
 627 </refsect3>
 628
 629 <refsect3>
 630         <title>domain trust delete <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 631         <para>Delete a domain trust.</para>
 632 </refsect3>
 633
 634 <refsect3>
 635         <title>domain trust list <replaceable>options</replaceable> [options]</title>
 636         <para>List domain trusts.</para>
 637 </refsect3>
 638
 639 <refsect3>
 640         <title>domain trust namespaces [<replaceable>DOMAIN</replaceable>] <replaceable>options</replaceable> [options]</title>
 641         <para>Manage forest trust namespaces.</para>
 642 </refsect3>
 643
 644 <refsect3>
 645         <title>domain trust show <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 646         <para>Show trusted domain details.</para>
 647 </refsect3>
 648
 649 <refsect3>
 650         <title>domain trust validate <replaceable>DOMAIN</replaceable> <replaceable>options</replaceable> [options]</title>
 651         <para>Validate a domain trust.</para>
 652 </refsect3>
 653
 654 <refsect2>
 655         <title>drs</title>
 656         <para>Manage Directory Replication Services (DRS).</para>
 657 </refsect2>
 658
 659 <refsect3>
 660         <title>drs bind</title>
 661         <para>Show DRS capabilities of a server.</para>
 662 </refsect3>
 663
 664 <refsect3>
 665         <title>drs kcc</title>
 666         <para>Trigger knowledge consistency center run.</para>
 667 </refsect3>
 668
 669 <refsect3>
 670         <title>drs options</title>
 671         <para>Query or change <replaceable>options</replaceable> for NTDS Settings
 672         object of a domain controller.</para>
 673 </refsect3>
 674
 675 <refsect3>
 676         <title>drs replicate <replaceable>destination_DC</replaceable> <replaceable>source_DC</replaceable> <replaceable>NC</replaceable> [options]</title>
 677         <para>Replicate a naming context between two DCs.</para>
 678 </refsect3>
 679
 680 <refsect3>
 681         <title>drs showrepl</title>
 682         <para>Show replication status. The <arg
 683         choice="opt">--json</arg> option results in JSON output, and
 684         with the <arg choice="opt">--summary</arg> option produces
 685         very little output when the replication status seems healthy.
 686         </para>
 687 </refsect3>
 688
 689 <refsect2>
 690         <title>dsacl</title>
 691         <para>Administer DS ACLs</para>
 692 </refsect2>
 693
 694 <refsect3>
 695         <title>dsacl set</title>
 696         <para>Modify access list on a directory object.</para>
 697 </refsect3>
 698
 699 <refsect2>
 700         <title>forest</title>
 701         <para>Manage Forest configuration.</para>
 702 </refsect2>
 703
 704 <refsect3>
 705         <title>forest directory_service</title>
 706         <para>Manage directory_service behaviour for the forest.</para>
 707 </refsect3>
 708
 709 <refsect3>
 710         <title>forest directory_service dsheuristics <replaceable>VALUE</replaceable></title>
 711         <para>Modify dsheuristics directory_service configuration for the forest.</para>
 712 </refsect3>
 713
 714 <refsect3>
 715         <title>forest directory_service show</title>
 716         <para>Show current directory_service configuration for the forest.</para>
 717 </refsect3>
 718
 719 <refsect2>
 720         <title>fsmo</title>
 721         <para>Manage Flexible Single Master Operations (FSMO).</para>
 722 </refsect2>
 723
 724 <refsect3>
 725         <title>fsmo seize [options]</title>
 726         <para>Seize the role.</para>
 727 </refsect3>
 728
 729 <refsect3>
 730         <title>fsmo show</title>
 731         <para>Show the roles.</para>
 732 </refsect3>
 733
 734 <refsect3>
 735         <title>fsmo transfer [options]</title>
 736         <para>Transfer the role.</para>
 737 </refsect3>
 738
 739 <refsect2>
 740         <title>gpo</title>
 741         <para>Manage Group Policy Objects (GPO).</para>
 742 </refsect2>
 743
 744 <refsect3>
 745         <title>gpo create <replaceable>displayname</replaceable> [options]</title>
 746         <para>Create an empty GPO.</para>
 747 </refsect3>
 748
 749 <refsect3>
 750         <title>gpo del <replaceable>gpo</replaceable> [options]</title>
 751         <para>Delete GPO.</para>
 752 </refsect3>
 753
 754 <refsect3>
 755         <title>gpo dellink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 756         <para>Delete GPO link from a container.</para>
 757 </refsect3>
 758
 759 <refsect3>
 760         <title>gpo fetch <replaceable>gpo</replaceable> [options]</title>
 761         <para>Download a GPO.</para>
 762 </refsect3>
 763
 764 <refsect3>
 765         <title>gpo getinheritance <replaceable>container_dn</replaceable> [options]</title>
 766         <para>Get inheritance flag for a container.</para>
 767 </refsect3>
 768
 769 <refsect3>
 770         <title>gpo getlink <replaceable>container_dn</replaceable> [options]</title>
 771         <para>List GPO Links for a container.</para>
 772 </refsect3>
 773
 774 <refsect3>
 775         <title>gpo list <replaceable>username</replaceable> [options]</title>
 776         <para>List GPOs for an account.</para>
 777 </refsect3>
 778
 779 <refsect3>
 780         <title>gpo listall</title>
 781         <para>List all GPOs.</para>
 782 </refsect3>
 783
 784 <refsect3>
 785         <title>gpo listcontainers <replaceable>gpo</replaceable> [options]</title>
 786         <para>List all linked containers for a GPO.</para>
 787 </refsect3>
 788
 789 <refsect3>
 790         <title>gpo setinheritance <replaceable>container_dn</replaceable> <replaceable>block|inherit</replaceable> [options]</title>
 791         <para>Set inheritance flag on a container.</para>
 792 </refsect3>
 793
 794 <refsect3>
 795         <title>gpo setlink <replaceable>container_dn</replaceable> <replaceable>gpo</replaceable> [options]</title>
 796         <para>Add or Update a GPO link to a container.</para>
 797 </refsect3>
 798
 799 <refsect3>
 800         <title>gpo show <replaceable>gpo</replaceable> [options]</title>
 801         <para>Show information for a GPO.</para>
 802 </refsect3>
 803
 804 <refsect2>
 805         <title>group</title>
 806         <para>Manage groups.</para>
 807 </refsect2>
 808
 809 <refsect3>
 810         <title>group add <replaceable>groupname</replaceable> [options]</title>
 811         <para>Create a new AD group.</para>
 812 </refsect3>
 813
 814 <refsect3>
 815         <title>group addmembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 816         <para>Add members to an AD group.</para>
 817 </refsect3>
 818
 819 <refsect3>
 820         <title>group delete <replaceable>groupname</replaceable> [options]</title>
 821         <para>Delete an AD group.</para>
 822 </refsect3>
 823
 824 <refsect3>
 825         <title>group edit <replaceable>groupname</replaceable></title>
 826         <para>Edit a group AD object.</para>
 827
 828         <variablelist>
 829         <varlistentry>
 830         <term>--editor=EDITOR</term>
 831         <listitem><para>
 832         Specifies the editor to use instead of the system default, or 'vi' if no
 833         system default is set.
 834         </para></listitem>
 835         </varlistentry>
 836         </variablelist>
 837 </refsect3>
 838
 839 <refsect3>
 840         <title>group list</title>
 841         <para>List all groups.</para>
 842 </refsect3>
 843
 844 <refsect3>
 845         <title>group listmembers <replaceable>groupname</replaceable> [options]</title>
 846         <para>List all members of the specified AD group.</para>
 847 </refsect3>
 848
 849 <refsect3>
 850         <title>group move <replaceable>groupname</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
 851         <para>This command moves a group into the specified organizational unit
 852         or container.</para>
 853         <para>The groupname specified on the command is the sAMAccountName.
 854         </para>
 855         <para>The name of the organizational unit or container can be
 856         specified as a full DN or without the domainDN component.</para>
 857         <para></para>
 858 </refsect3>
 859
 860 <refsect3>
 861         <title>group removemembers <replaceable>groupname</replaceable> <replaceable>members</replaceable> [options]</title>
 862         <para>Remove members from the specified AD group.</para>
 863 </refsect3>
 864
 865 <refsect3>
 866         <title>group show <replaceable>groupname</replaceable> [options]</title>
 867         <para>Show group object and it's attributes.</para>
 868 </refsect3>
 869
 870 <refsect3>
 871         <title>group stats [options]</title>
 872         <para>Show statistics for overall groups and group memberships.</para>
 873 </refsect3>
 874
 875 <refsect2>
 876         <title>ldapcmp <replaceable>URL1</replaceable> <replaceable>URL2</replaceable> <replaceable>domain|configuration|schema|dnsdomain|dnsforest</replaceable> [options] </title>
 877         <para>Compare two LDAP databases.</para>
 878 </refsect2>
 879
 880 <refsect2>
 881         <title>ntacl</title>
 882         <para>Manage NT ACLs.</para>
 883 </refsect2>
 884
 885 <refsect3>
 886         <title>ntacl changedomsid <replaceable>original-domain-SID</replaceable> <replaceable>new-domain-SID</replaceable> <replaceable>file</replaceable> [options]</title>
 887         <para>Change the domain SID for ACLs.
 888         Can be used to change all entries in acl_xattr when the machine's SID
 889         has accidentally changed or the data set has been copied
 890         to another machine either via backup/restore or rsync.</para>
 891
 892         <variablelist>
 893         <varlistentry>
 894         <term>--use-ntvfs</term>
 895         <listitem><para>
 896         Set the ACLs directly to the TDB or xattr. The POSIX permissions will
 897         NOT be changed, only the NT ACL will be stored.
 898         </para></listitem>
 899         </varlistentry>
 900
 901         <varlistentry>
 902         <term>--service=SERVICE</term>
 903         <listitem><para>
 904         Specify the name of the smb.conf service to use. This option is
 905         required in combination with the --use-s3fs option.
 906         </para></listitem>
 907         </varlistentry>
 908
 909         <varlistentry>
 910         <term>--use-s3fs</term>
 911         <listitem><para>
 912         Set the ACLs for use with the default s3fs file server via the VFS
 913         layer. This option requires a smb.conf service, specified by the
 914         --service=SERVICE option.
 915         </para></listitem>
 916         </varlistentry>
 917
 918         <varlistentry>
 919         <term>--xattr-backend=[native|tdb]</term>
 920         <listitem><para>
 921         Specify the xattr backend type (native fs or tdb).
 922         </para></listitem>
 923         </varlistentry>
 924
 925         <varlistentry>
 926         <term>--eadb-file=EADB_FILE</term>
 927         <listitem><para>
 928         Name of the tdb file where attributes are stored.
 929         </para></listitem>
 930         </varlistentry>
 931
 932         <varlistentry>
 933         <term>--recursive</term>
 934         <listitem><para>
 935         Set the ACLs for directories and their contents recursively.
 936         </para></listitem>
 937         </varlistentry>
 938
 939         <varlistentry>
 940         <term>--follow-symlinks</term>
 941         <listitem><para>
 942         Follow symlinks when --recursive is specified.
 943         </para></listitem>
 944         </varlistentry>
 945
 946         <varlistentry>
 947         <term>--verbose</term>
 948         <listitem><para>
 949         Verbosely list files and ACLs which are being processed.
 950         </para></listitem>
 951         </varlistentry>
 952         </variablelist>
 953 </refsect3>
 954
 955
 956 <refsect3>
 957         <title>ntacl get <replaceable>file</replaceable> [options]</title>
 958         <para>Get ACLs on a file.</para>
 959 </refsect3>
 960
 961 <refsect3>
 962         <title>ntacl set <replaceable>acl</replaceable> <replaceable>file</replaceable> [options]</title>
 963         <para>Set ACLs on a file.</para>
 964 </refsect3>
 965
 966 <refsect3>
 967         <title>ntacl sysvolcheck</title>
 968         <para>Check sysvol ACLs match defaults (including correct ACLs on GPOs).</para>
 969 </refsect3>
 970
 971 <refsect3>
 972         <title>ntacl sysvolreset</title>
 973         <para>Reset sysvol ACLs to defaults (including correct ACLs on GPOs).</para>
 974 </refsect3>
 975
 976 <refsect2>
 977         <title>ou</title>
 978         <para>Manage organizational units (OUs).</para>
 979 </refsect2>
 980
 981 <refsect3>
 982         <title>ou create <replaceable>ou_dn</replaceable> [options]</title>
 983         <para>Create an organizational unit.</para>
 984         <para>The name of the organizational unit can be specified as a full DN
 985         or without the domainDN component.</para>
 986
 987         <variablelist>
 988         <varlistentry>
 989         <term>--description=DESCRIPTION</term>
 990         <listitem><para>
 991         Specify OU's description.
 992         </para></listitem>
 993         </varlistentry>
 994         </variablelist>
 995 </refsect3>
 996
 997 <refsect3>
 998         <title>ou delete <replaceable>ou_dn</replaceable> [options]</title>
 999         <para>Delete an organizational unit.</para>
1000         <para>The name of the organizational unit can be specified as a full DN
1001         or without the domainDN component.</para>
1002
1003         <variablelist>
1004         <varlistentry>
1005         <term>--force-subtree-delete</term>
1006         <listitem><para>
1007         Delete organizational unit and all children reclusively.
1008         </para></listitem>
1009         </varlistentry>
1010         </variablelist>
1011 </refsect3>
1012
1013 <refsect3>
1014         <title>ou list [options]</title>
1015         <para>List all organizational units.</para>
1016         <variablelist>
1017         <varlistentry>
1018         <term>--full-dn</term>
1019         <listitem><para>
1020         Display DNs including the base DN.
1021         </para></listitem>
1022         </varlistentry>
1023         </variablelist>
1024 </refsect3>
1025
1026 <refsect3>
1027         <title>ou listobjects <replaceable>ou_dn</replaceable> [options]</title>
1028         <para>List all objects in an organizational unit.</para>
1029         <para>The name of the organizational unit can be specified as a full DN
1030         or without the domainDN component.</para>
1031
1032         <variablelist>
1033         <varlistentry>
1034         <term>--full-dn</term>
1035         <listitem><para>
1036         Display DNs including the base DN.
1037         </para></listitem>
1038         </varlistentry>
1039
1040         <varlistentry>
1041         <term>-r|--recursive</term>
1042         <listitem><para>
1043         List objects recursively.
1044         </para></listitem>
1045         </varlistentry>
1046         </variablelist>
1047 </refsect3>
1048
1049 <refsect3>
1050         <title>ou move <replaceable>old_ou_dn</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
1051         <para>Move an organizational unit.</para>
1052         <para>The name of the organizational units can be specified as a full DN
1053         or without the domainDN component.</para>
1054 </refsect3>
1055
1056 <refsect3>
1057         <title>ou rename <replaceable>old_ou_dn</replaceable> <replaceable>new_ou_dn</replaceable> [options]</title>
1058         <para>Rename an organizational unit.</para>
1059         <para>The name of the organizational units can be specified as a full DN
1060         or without the domainDN component.</para>
1061 </refsect3>
1062
1063 <refsect2>
1064         <title>rodc</title>
1065         <para>Manage Read-Only Domain Controller (RODC).</para>
1066 </refsect2>
1067
1068 <refsect3>
1069         <title>rodc preload <replaceable>SID</replaceable>|<replaceable>DN</replaceable>|<replaceable>accountname</replaceable> [options]</title>
1070         <para>Preload one account for an RODC.</para>
1071 </refsect3>
1072
1073 <refsect2>
1074         <title>schema</title>
1075         <para>Manage and query schema.</para>
1076 </refsect2>
1077
1078 <refsect3>
1079         <title>schema attribute modify <replaceable>attribute</replaceable> [options]</title>
1080         <para>Modify the behaviour of an attribute in schema.</para>
1081 </refsect3>
1082
1083 <refsect3>
1084         <title>schema attribute show <replaceable>attribute</replaceable> [options]</title>
1085         <para>Display an attribute schema definition.</para>
1086 </refsect3>
1087
1088 <refsect3>
1089         <title>schema attribute show_oc <replaceable>attribute</replaceable> [options]</title>
1090         <para>Show objectclasses that MAY or MUST contain this attribute.</para>
1091 </refsect3>
1092
1093 <refsect3>
1094         <title>schema objectclass show <replaceable>objectclass</replaceable> [options]</title>
1095         <para>Display an objectclass schema definition.</para>
1096 </refsect3>
1097
1098 <refsect2>
1099         <title>sites</title>
1100         <para>Manage sites.</para>
1101 </refsect2>
1102
1103 <refsect3>
1104         <title>sites create <replaceable>site</replaceable> [options]</title>
1105         <para>Create a new site.</para>
1106 </refsect3>
1107
1108 <refsect3>
1109         <title>sites remove <replaceable>site</replaceable> [options]</title>
1110         <para>Delete an existing site.</para>
1111 </refsect3>
1112
1113 <refsect2>
1114         <title>spn</title>
1115         <para>Manage Service Principal Names (SPN).</para>
1116 </refsect2>
1117
1118 <refsect3>
1119         <title>spn add <replaceable>name</replaceable> <replaceable>user</replaceable> [options]</title>
1120         <para>Create a new SPN.</para>
1121 </refsect3>
1122
1123 <refsect3>
1124         <title>spn delete <replaceable>name</replaceable> [<replaceable>user</replaceable>] [options]</title>
1125         <para>Delete an existing SPN.</para>
1126 </refsect3>
1127
1128 <refsect3>
1129         <title>spn list <replaceable>user</replaceable> [options]</title>
1130         <para>List SPNs of a given user.</para>
1131 </refsect3>
1132
1133 <refsect2>
1134         <title>testparm</title>
1135         <para>Check the syntax of the configuration file.</para>
1136 </refsect2>
1137
1138 <refsect2>
1139         <title>time</title>
1140         <para>Retrieve the time on a server.</para>
1141 </refsect2>
1142
1143 <refsect2>
1144         <title>user</title>
1145         <para>Manage users.</para>
1146 </refsect2>
1147
1148 <refsect3>
1149         <title>user add <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
1150         <para>Create a new user. Please note that this subcommand is deprecated
1151         and available for compatibility reasons only. Please use
1152         <command>samba-tool user create</command> instead.</para>
1153 </refsect3>
1154
1155 <refsect3>
1156         <title>user create <replaceable>username</replaceable> [<replaceable>password</replaceable>]</title>
1157         <para>Create a new user in the Active Directory Domain.</para>
1158 </refsect3>
1159
1160 <refsect3>
1161         <title>user delete <replaceable>username</replaceable> [options]</title>
1162         <para>Delete an existing user account.</para>
1163 </refsect3>
1164
1165 <refsect3>
1166         <title>user disable <replaceable>username</replaceable></title>
1167         <para>Disable a user account.</para>
1168 </refsect3>
1169
1170 <refsect3>
1171         <title>user edit <replaceable>username</replaceable></title>
1172         <para>Edit a user account AD object.</para>
1173
1174         <variablelist>
1175         <varlistentry>
1176         <term>--editor=EDITOR</term>
1177         <listitem><para>
1178         Specifies the editor to use instead of the system default, or 'vi' if no
1179         system default is set.
1180         </para></listitem>
1181         </varlistentry>
1182         </variablelist>
1183 </refsect3>
1184
1185 <refsect3>
1186         <title>user enable <replaceable>username</replaceable></title>
1187         <para>Enable a user account.</para>
1188 </refsect3>
1189
1190 <refsect3>
1191         <title>user list</title>
1192         <para>List all users.</para>
1193 </refsect3>
1194
1195 <refsect3>
1196         <title>user setprimarygroup <replaceable>username</replaceable> <replaceable>primarygroupname</replaceable></title>
1197         <para>Set the primary group a user account.</para>
1198 </refsect3>
1199
1200 <refsect3>
1201         <title>user show <replaceable>username</replaceable> [options]</title>
1202         <para>Display a user AD object.</para>
1203
1204         <variablelist>
1205         <varlistentry>
1206         <term>--attributes=USER_ATTRS</term>
1207         <listitem><para>
1208         Comma separated list of attributes, which will be printed.
1209         </para></listitem>
1210         </varlistentry>
1211         </variablelist>
1212 </refsect3>
1213
1214 <refsect3>
1215         <title>user move <replaceable>username</replaceable> <replaceable>new_parent_dn</replaceable> [options]</title>
1216         <para>This command moves a user account into the specified
1217         organizational unit or container.</para>
1218         <para>The username specified on the command is the
1219         sAMAccountName.</para>
1220         <para>The name of the organizational unit or container can be
1221         specified as a full DN or without the domainDN component.</para>
1222 </refsect3>
1223
1224 <refsect3>
1225         <title>user password [options]</title>
1226         <para>Change password for a user account (the one provided in
1227         authentication).</para>
1228 </refsect3>
1229
1230 <refsect3>
1231         <title>user setexpiry <replaceable>username</replaceable> [options]</title>
1232         <para>Set the expiration of a user account.</para>
1233 </refsect3>
1234
1235 <refsect3>
1236         <title>user setpassword <replaceable>username</replaceable> [options]</title>
1237         <para>Sets or resets the password of a user account.</para>
1238 </refsect3>
1239
1240 <refsect3>
1241         <title>user getpassword <replaceable>username</replaceable> [options]</title>
1242         <para>Gets the password of a user account.</para>
1243 </refsect3>
1244
1245 <refsect3>
1246         <title>user syncpasswords <replaceable>--cache-ldb-initialize</replaceable> [options]</title>
1247         <para>Syncs the passwords of all user accounts, using an optional script.</para>
1248         <para>Note that this command should run on a single domain controller only
1249         (typically the PDC-emulator).</para>
1250 </refsect3>
1251
1252 <refsect2>
1253         <title>vampire [options] <replaceable>domain</replaceable></title>
1254         <para>Join and synchronise a remote AD domain to the local server.
1255         Please note that <command>samba-tool vampire</command> is deprecated,
1256         please use <command>samba-tool domain join</command> instead.</para>
1257 </refsect2>
1258
1259 <refsect2>
1260         <title>visualize [options] <replaceable>subcommand</replaceable></title>
1261         <para>Produce graphical representations of Samba network state.
1262         To work out what is happening in a replication graph, it is sometimes
1263         helpful to use visualisations.</para>
1264
1265         <para>
1266         There are two subcommands, two graphical modes, and (roughly) two modes
1267         of operation with respect to the location of authority.</para>
1268
1269         <refsect3><title>MODES OF OPERATION</title>
1270         <varlistentry>
1271                 <term>samba-tool visualize ntdsconn</term>
1272                 <listitem><para>Looks at NTDS connections.
1273                 </para></listitem>
1274                 </varlistentry>
1275
1276         <varlistentry>
1277                 <term>samba-tool visualize reps</term>
1278                 <listitem><para>Looks at repsTo and repsFrom objects.
1279                 </para></listitem>
1280                 </varlistentry>
1281
1282         <varlistentry>
1283                 <term>samba-tool visualize uptodateness</term>
1284                 <listitem><para>Looks at replication lag as shown by the
1285                 uptodateness vectors.
1286                 </para></listitem>
1287                 </varlistentry>
1288         </refsect3>
1289
1290         <refsect3><title>GRAPHICAL MODES</title>
1291         <varlistentry>
1292                 <term>--distance</term>
1293                 <listitem><para>Distances between DCs are shown in a matrix in
1294                  the terminal.
1295                 </para></listitem>
1296                 </varlistentry>
1297
1298         <varlistentry>
1299                 <term>--dot</term>
1300                 <listitem><para>Generate Graphviz dot output (for
1301                 ntdsconn and reps modes). When viewed using dot or
1302                 xdot, this shows the network as a graph with DCs as
1303                 vertices and connections edges. Certain types of
1304                 degenerate edges are shown in different colours or
1305                 line-styles. </para></listitem>
1306                 </varlistentry>
1307         <varlistentry>
1308                 <term>--xdot</term>
1309                 <listitem><para>Generate Graphviz dot output as with
1310                 <arg choice="opt">--dot</arg> and attempt to view it
1311                 immediately using <command>/usr/bin/xdot</command>.
1312                 </para></listitem>
1313                 </varlistentry>
1314         </refsect3>
1315
1316         <varlistentry>
1317                 <term>-r</term>
1318                 <listitem><para>Normally,
1319                 <command>samba-tool</command> talks to one database;
1320                 with the <arg choice="opt">-r</arg> option attempts
1321                 are made to contact all the DCs known to the first
1322                 database. This is necessary for <command>samba-tool
1323                 visualize uptodateness</command> and for
1324                 <command>samba-tool visualize reps</command> because
1325                 the repsFrom/To objects are not replicated, and it can
1326                 reveal replication issues in other modes.
1327                 </para></listitem>
1328                 </varlistentry>
1329 </refsect2>
1330
1331 <refsect2>
1332 <title>help</title>
1333 <para>Gives usage information.</para>
1334 </refsect2>
1335
1336 </refsect1>
1337
1338 <refsect1>
1339         <title>VERSION</title>
1340
1341         <para>This man page is complete for version &doc.version; of the Samba
1342         suite.</para>
1343 </refsect1>
1344
1345 <refsect1>
1346         <title>AUTHOR</title>
1347
1348         <para>The original Samba software and related utilities
1349         were created by Andrew Tridgell. Samba is now developed
1350         by the Samba Team as an Open Source project similar
1351         to the way the Linux kernel is developed.</para>
1352 </refsect1>
1353
1354 </refentry>